News for hackers. Stuff that matters.

A comment on Xzbot: Notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094). Parent comment

Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by halJordan on Monday April 01, 2024 @04:42PM (#39899045)
This is not that concept. That concept is no one but us can technically complete the exploit. Technical feasibility in that you need a supercomputer to do it, not protecting a backdoor with the normal cia triad
[ Parent | on HN ]
Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by justinclift on Monday April 01, 2024 @07:41PM (#39900723)
That doesn't seem correct:

    If they determine the vulnerability is only exploitable by the NSA for reasons
    such as computational resources, budget, or skill set, they label it as NOBUS
    and will not move to patch it, but rather leave it open to exploit against current
    or future targets.
If (!) the NSA regards ssh keys as secure, then from that article it sounds like the NOBUS thing would fit.
[ Parent | on HN ]
Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by CommitSyn on Tuesday April 02, 2024 @02:15AM (#39902860)
That would only fit "If (!) the NSA regards ssh keys as secure >for everyone but them<
[ Parent | on HN ]
Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by justinclift on Tuesday April 02, 2024 @09:18AM (#39905420)
Not sure why? My thinking in this hypothetical scenario is that the NSA would have the private key, which is why it would be a NOBUS thing.

If they didn't have the key though, then yeah it doesn't fit. Unless they can walk through ssh key security anyway. :)

[ Parent | on HN ]
Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by bed99 on Tuesday April 02, 2024 @03:24PM (#39909834)
Is it legal and possible for the NSA to socially attack someone with mental health issues this way?

I'd like to rule-out some state actors by the mere heartbreaking act of socially engineering and targeting a person in pain.

Not even considering the original maintainer may be a US citizen (idk).

[ Parent | on HN ]
Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by account42 on Tuesday April 09, 2024 @09:33AM (#39979259)
You do realize that plenty of state actors have no qualms with physically torturing and killing people in the most gruesome ways possible, right? Online bullying is peanuts in that context.
[ Parent | on HN ]